Description Jens Thorp-Hansen 2016-10-27 14:22:56 CEST

if in the password-policy for a user the values for univentionPWLength or univentionPWHistoryLen are left empty (instead of i.e. "0") this user cannot change his password. 

kpasswd throws:

Soft error : External password quality program failed: Traceback (most recent call last): [no traceback appears...]

The strace - traceback points to the solution: 
7604  read(13, "Traceback (most recent call last):\n  File \"/usr/share/univention-heimdal/check_cracklib.py\", line 64, in <module>\n    pwdCheck = univention.password.Check(None, params['principal'])\n  File \"/usr/lib/pymodules/python2.7/univention/password.py\", line 51, in __init__\n    self._userPolicy(username)\n  File \"/usr/lib/pymodules/python2.7/univention/password.py\", line 96, in _userPolicy\n    self.history_length=int(policy_result['univentionPolicyPWHistory']['univentionPWHistoryLen']['value'][0])\nKeyError: 'univentionPWHistoryLen'\n", 4096) = 527

The related codesnippet from the password.py:
                policy_result = self.lo.getPolicies(dn)
                if policy_result.get('univentionPolicyPWHistory'):
                        self.min_length=int(policy_result['univentionPolicyPWHistory']['univentionPWLength']['value'][0])
                        self.history_length=int(policy_result['univentionPolicyPWHistory']['univentionPWHistoryLen']['value'][0])
                        if policy_result['univentionPolicyPWHistory'].get('univentionPWQualityCheck'):
                                univentionPasswordQualityCheck = policy_result['univentionPolicyPWHistory']['univentionPWQualityCheck']['value'][0]
                                if univentionPasswordQualityCheck.lower() in ['yes', 'true', '1', 'on' ]:
                                        self.enableQualityCheck = True
                self.pwhistory = self.lo.search(base=dn, attr=['pwhistory'])[0][1].get('pwhistory')